Topic starter
19/08/2026 3:54 pm
TL;DR: Weak access control, exposed secrets, unchecked dependencies, and overbroad deployment permissions can move attackers from source access to production compromise, according to Appknox. The security model must shift from post-build review to identity-aware, automated controls embedded across the delivery chain.
Editorial analysis by NHI Mgmt Group, based on content published by Appknox: “CI/CD Security Checklist for Engineering Managers”.
Key questions
Q: Why do security controls often fail in fast-moving CI/CD environments?
A: They usually fail because they arrive too late or ask for manual work at the point where teams are optimising for speed.
Q: Why do weak pipeline controls create production risk so quickly?
A: Because CI/CD systems concentrate privileged actions into a small number of automated jobs.
Q: What signs show that CI/CD identities are being overused?
A: Common signals include the same credential being reused across jobs, build machines retaining state between runs, secrets appearing in configuration files, and deploy permissions that are broader than the release task requires.
Practitioner guidance
- Enforce MFA and RBAC across pipeline consoles Require MFA on source control, CI platforms, and artifact repositories, then remove inactive accounts and review role assignments against current delivery responsibilities.
- Move all pipeline secrets into external managers Keep credentials out of repositories, CI/CD YAML files, and plaintext environment variables, and issue them only through managed secret stores or short-lived identity flows.
- Use ephemeral runners for build isolation Avoid reusing build machines so each job starts from a clean state and cannot inherit tokens, cached material, or malicious residue from earlier runs.
Bottom line: CI/CD compromise is often an identity and secrets problem first, and a code problem second.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:31 pm
CI/CD security is now identity security by another name: the pipeline only stays trustworthy when machine identities, secrets, and deployment permissions are continuously governed. Appknox’s checklist reinforces a basic reality that many teams still underweight, which is that build systems now hold production-grade authority. Practitioners should treat pipeline trust as an IAM and NHI governance problem, not just a developer workflow issue.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams balance delivery speed with pipeline security?
A: By moving controls earlier and automating them. Teams should verify access, secrets, dependencies, and artifact integrity during the build and pre-deploy stages so security checks do not depend on manual review after the fact. The goal is to make safe delivery the default path, not an extra approval layer added at the end.
👉 Read our full editorial: CI/CD security gaps are still exposing build secrets and deploy access